1298344 - Investigate suspicious total_uri_count values

Status: NEW

(Toolkit :: Telemetry, defect, P3)

Description

[Alessio Placitelli [:Dexter]]

In bug 1276200 we found that an handful of clients are loading URIs very frequently (more than 10k URI loads per subsession). This could be scripted Firefox instances (bots or our automation).

We should dig into the data and figure out what's happening.

Comment 1

[Alessio Placitelli [:Dexter]]

What we know so far:

- We're only seeing 11 clients (0.0%) in the week from Aug. 15th, 2016 to Aug. 22nd, 2016.
- Some stats about these clients, per client (# URIs min, # URIs max, [p75, p95], # samples):

[(2, 44102, array([ 30251.5 ,  42022.65]), 8),
 (3, 16630, array([  421.5,  8779.5]), 11),
 (1, 11920, array([   44.75,  6614.5 ]), 10),
 (1, 11269, array([ 2836.75,  9582.55]), 4),
 (4280, 16728, array([ 15661.5,  16514.7]), 4),
 (1, 47162, array([   117.5,  16462.8]), 15),
 (2, 17137, array([   98. ,  4908.2]), 65),
 (1, 11416, array([  210. ,  2186.7]), 18),
 (20, 29215, array([   353. ,  20603.2]), 7),
 (18, 20951, array([  4624. ,  17685.6]), 5),
 (2, 12840, array([ 3039.5,  7322.8]), 75)]

- The length of the subsessions for these clients span from a few minutes to a day.

(In reply to Georg Fritzsche [:gfritzsche] from bug 1276200 comment #14)
> * [61], if this is automation, i would look for:
>  * either a new or constantly resetting profile
>  * low session counts (1 or "few", profileSubsessionCounter as a proxy?)
>  * lower session lengths
>  * submit high counts with each session.
>    Maybe a proxy is "for pathological clients, the uri counts p25 is pretty
> close to p90"?

All of these are unfortunately not true for these clients.